PT-2021-21151 · Apache · Apache Dubbo

Alvaro Munoz · Published 2021-09-07 · Updated 2021-09-14 · CVE-2021-36163

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Dubbo versions prior to 2.7.13 Apache Dubbo versions prior to 2.6.10.1

Description The issue concerns the Hessian protocol in Apache Dubbo, which is implemented on top of HTTP. The HessianSkeleton is created without configuration of the serialization factory, and thus without applying allowed or blocked type lists. Additionally, the generic service is always exposed, making it easier for attackers as they do not need to find a valid service/method name pair.

Recommendations For versions prior to 2.7.13, update to version 2.7.13 or later. For versions prior to 2.6.10.1, update to version 2.6.10.1 or later.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-36163

GHSA-CPX9-4RWV-486V

Affected Products

Apache Dubbo

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2021-36163 · Security Note
• https://lists.apache.org/thread.html/r8d0adc057bb15a37199502cc366f4b1164c9c536ce28e4defdb428c0%40%3Cdev.dubbo.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cpx9-4rwv-486v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36163 · Vendor Advisory
• https://github.com/apache/dubbo/releases/tag/dubbo-2.7.13 · Note
• https://github.com/apache/dubbo/pull/8238 · Note
• https://github.com/apache/dubbo/releases/tag/dubbo-2.6.10.1 · Note
• https://github.com/apache/dubbo · Note